controlpacks

Documentation

Overview

Package controlpacks defines the control-pack manifest schema and the read-only discovery of packs already installed on disk. It is deliberately public (unlike internal/controlpacks, which owns OCI fetch + cosign verify): any consumer — including the platform server, a separate module — can read the catalog an installed, verified pack provides without depending on the installer machinery.

Index

• Constants
• func ControlsDirs(packs []Discovered) []string
• func PackDir(installRoot, framework, version string) string
• func ResolveInstallRoot(root string) (string, error)
• type Discovered
  • func Discover(installRoot string) ([]Discovered, error)
• type EvidenceSource
• type Pack
  • func ParsePack(path string) (*Pack, error)
  • func ParsePackTarball(tgz []byte) (*Pack, error)
  • func (p *Pack) EvidenceSourceNames() []string
  • func (p *Pack) Validate() error
• type PackMetadata
• type PackSpec

Constants

const PackFile = "pack.yaml"

PackFile is the metadata file at the root of every control pack.

Functions

func ControlsDirs

func ControlsDirs(packs []Discovered) []string

ControlsDirs returns the directories containing per-control YAML for a control loader to walk: each pack's controls/ subdir, or the pack root when that subdir is absent.

func PackDir

func PackDir(installRoot, framework, version string) string

PackDir is the on-disk location for an installed pack.

func ResolveInstallRoot

func ResolveInstallRoot(root string) (string, error)

ResolveInstallRoot returns the pack install root, defaulting to ~/.concord/controlpacks when root is empty.

Types

type Discovered

type Discovered struct {
	Framework string
	Version   string
	Dir       string
	Pack      *Pack
}

Discovered describes a single control pack found on disk.

func Discover

func Discover(installRoot string) ([]Discovered, error)

Discover walks installRoot and returns every readable, schema-valid pack (newest version per framework). An absent root is not an error — it yields no packs, so a consumer can call it unconditionally.

type EvidenceSource

type EvidenceSource struct {
	Source  string `json:"source"  yaml:"source"`
	Version string `json:"version" yaml:"version"`
}

EvidenceSource declares a semver constraint on a plugin source.

type Pack

type Pack struct {
	APIVersion string       `json:"apiVersion" yaml:"apiVersion"`
	Kind       string       `json:"kind"       yaml:"kind"`
	Metadata   PackMetadata `json:"metadata"   yaml:"metadata"`
	Spec       PackSpec     `json:"spec"       yaml:"spec"`
}

Pack is the parsed pack.yaml document.

func ParsePack

func ParsePack(path string) (*Pack, error)

ParsePack reads and validates a pack.yaml file.

func ParsePackTarball

func ParsePackTarball(tgz []byte) (*Pack, error)

ParsePackTarball reads pack.yaml from a gzipped tar byte slice without writing to disk.

func (*Pack) EvidenceSourceNames

func (p *Pack) EvidenceSourceNames() []string

EvidenceSourceNames returns the unique source names this pack declares it needs.

func (*Pack) Validate

func (p *Pack) Validate() error

Validate enforces the pack.yaml schema invariants.

type PackMetadata

type PackMetadata struct {
	ID             string `json:"id"                         yaml:"id"`
	Name           string `json:"name,omitempty"             yaml:"name,omitempty"`
	Version        string `json:"version"                    yaml:"version"`
	FrameworkLabel string `json:"framework_label,omitempty"  yaml:"framework_label,omitempty"`
}

PackMetadata identifies the framework this pack implements.

type PackSpec

type PackSpec struct {
	Controls        []string         `json:"controls,omitempty"         yaml:"controls,omitempty"`
	EvidenceSources []EvidenceSource `json:"evidence_sources,omitempty" yaml:"evidence_sources,omitempty"`
}

PackSpec declares the controls + evidence dependencies the pack provides.